Skip to content

Commit 8059148

Browse files
dr-mdr-m
committed
Merge 10.3 into 10.4
2 parents 95ac790 + 8300f63 commit 8059148

29 files changed

+506
-383
lines changed

‎CMakeLists.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ CMAKE_MINIMUM_REQUIRED(VERSION 2.8.7)
1919
IF(POLICY CMP0022)
2020
CMAKE_POLICY(SET CMP0022 NEW)
2121
ENDIF()
22+
IF(POLICY CMP0048)
23+
CMAKE_POLICY(SET CMP0048 NEW)
24+
ENDIF()
2225
IF(POLICY CMP0054)
2326
CMAKE_POLICY(SET CMP0054 NEW)
2427
ENDIF()

‎cmake/FindBISON.cmake

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
IF(DEFINED BISON_EXECUTABLE)
2+
SET(bison_quiet QUIET)
3+
ENDIF()
4+
5+
set(orig_CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH})
6+
unset(CMAKE_MODULE_PATH)
7+
find_package(BISON ${BISON_FIND_VERSION} ${bison_quiet} ${BISON_FIND_REQUIRED})
8+
set(CMAKE_MODULE_PATH ${orig_CMAKE_MODULE_PATH})

‎mysql-test/suite/roles/set_default_role_for.result

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ set default role role_a for user_a@localhost;
1414
set default role invalid_role for user_a@localhost;
1515
ERROR OP000: Invalid role specification `invalid_role`
1616
set default role role_b for user_a@localhost;
17-
ERROR OP000: Invalid role specification `role_b`
17+
ERROR OP000: User `user_a@localhost` has not been granted role `role_b`
1818
set default role role_b for user_b@localhost;
1919
show grants;
2020
Grants for user_a@localhost
@@ -36,7 +36,7 @@ User Host default_role
3636
user_a localhost role_a
3737
user_b localhost role_b
3838
set default role role_b for current_user;
39-
ERROR OP000: Invalid role specification `role_b`
39+
ERROR OP000: User `user_a@localhost` has not been granted role `role_b`
4040
show grants;
4141
Grants for user_b@localhost
4242
GRANT `role_b` TO `user_b`@`localhost`

‎mysql-test/suite/roles/set_default_role_invalid.result

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,90 @@ ERROR 42000: SELECT command denied to user 'test_user'@'localhost' for table 'us
3838
drop role test_role;
3939
drop role not_granted_role;
4040
drop user test_user@localhost;
41+
#
42+
# MDEV-22312: Bad error message for SET DEFAULT ROLE when user account
43+
# is not granted the role
44+
#
45+
CREATE USER a;
46+
CREATE USER b;
47+
CREATE ROLE r1;
48+
CREATE ROLE r2;
49+
SET DEFAULT ROLE r1 FOR a;
50+
ERROR OP000: User `a@%` has not been granted role `r1`
51+
GRANT r1 TO b;
52+
GRANT r2 TO b;
53+
SET DEFAULT ROLE r1 FOR b;
54+
# Change user b
55+
SELECT CURRENT_ROLE;
56+
CURRENT_ROLE
57+
r1
58+
SET ROLE r2;
59+
SELECT CURRENT_ROLE;
60+
CURRENT_ROLE
61+
r2
62+
SET DEFAULT ROLE r1 FOR a;
63+
ERROR 42000: Access denied for user 'b'@'%' to database 'mysql'
64+
SET DEFAULT ROLE r2;
65+
# Change user root (session 1: select_priv to b)
66+
GRANT SELECT ON mysql.* TO b;
67+
# Change user b (session 1: select_priv)
68+
SHOW GRANTS FOR b;
69+
Grants for b@%
70+
GRANT `r1` TO `b`@`%`
71+
GRANT `r2` TO `b`@`%`
72+
GRANT USAGE ON *.* TO `b`@`%`
73+
GRANT SELECT ON `mysql`.* TO `b`@`%`
74+
SET DEFAULT ROLE r1 FOR a;
75+
ERROR 42000: Access denied for user 'b'@'%' to database 'mysql'
76+
SELECT CURRENT_ROLE;
77+
CURRENT_ROLE
78+
r2
79+
SET DEFAULT ROLE NONE;
80+
SELECT CURRENT_ROLE;
81+
CURRENT_ROLE
82+
r2
83+
SET DEFAULT ROLE current_role FOR current_user;
84+
SET DEFAULT ROLE invalid_role;
85+
ERROR OP000: Invalid role specification `invalid_role`
86+
SET DEFAULT ROLE invalid_role FOR a;
87+
ERROR 42000: Access denied for user 'b'@'%' to database 'mysql'
88+
SET DEFAULT ROLE none FOR a;
89+
ERROR 42000: Access denied for user 'b'@'%' to database 'mysql'
90+
# Change user root (session 2: adding update_priv to user b)
91+
GRANT UPDATE ON mysql.* TO b;
92+
# Change user b
93+
SHOW GRANTS FOR b;
94+
Grants for b@%
95+
GRANT `r1` TO `b`@`%`
96+
GRANT `r2` TO `b`@`%`
97+
GRANT USAGE ON *.* TO `b`@`%`
98+
GRANT SELECT, UPDATE ON `mysql`.* TO `b`@`%`
99+
SET DEFAULT ROLE r1 FOR a;
100+
ERROR OP000: User `a@%` has not been granted role `r1`
101+
SET DEFAULT ROLE invalid_role;
102+
ERROR OP000: Invalid role specification `invalid_role`
103+
SET DEFAULT ROLE invalid_role FOR a;
104+
ERROR OP000: Invalid role specification `invalid_role`
105+
SET DEFAULT ROLE none FOR a;
106+
# Change user root (session 3: Grant role to user a)
107+
GRANT r1 TO a;
108+
SET DEFAULT ROLE r1 FOR a;
109+
# Change user a (verify session 3)
110+
SELECT CURRENT_ROLE;
111+
CURRENT_ROLE
112+
r1
113+
SET DEFAULT ROLE None;
114+
# Change user b (session 3: role granted to user a)
115+
SET DEFAULT ROLE r1 FOR a;
116+
SET DEFAULT ROLE r2 FOR a;
117+
ERROR OP000: User `a@%` has not been granted role `r2`
118+
SET DEFAULT ROLE invalid_role;
119+
ERROR OP000: Invalid role specification `invalid_role`
120+
SET DEFAULT ROLE invalid_role FOR a;
121+
ERROR OP000: Invalid role specification `invalid_role`
122+
SELECT user, host, default_role FROM mysql.user where user='a' or user='b';
123+
User Host default_role
124+
a % r1
125+
b % r2
126+
DROP ROLE r1, r2;
127+
DROP USER a, b;

‎mysql-test/suite/roles/set_default_role_invalid.test

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,110 @@ change_user 'root';
6060
drop role test_role;
6161
drop role not_granted_role;
6262
drop user test_user@localhost;
63+
64+
--echo #
65+
--echo # MDEV-22312: Bad error message for SET DEFAULT ROLE when user account
66+
--echo # is not granted the role
67+
--echo #
68+
69+
CREATE USER a;
70+
CREATE USER b;
71+
CREATE ROLE r1;
72+
CREATE ROLE r2;
73+
# Role has not been granted to user a, but the role is visible to current_user
74+
--error ER_INVALID_ROLE
75+
SET DEFAULT ROLE r1 FOR a;
76+
# Granting roles to user b
77+
GRANT r1 TO b;
78+
GRANT r2 TO b;
79+
# After granting the role, role can be set as default
80+
SET DEFAULT ROLE r1 FOR b;
81+
82+
--echo # Change user b
83+
change_user b;
84+
SELECT CURRENT_ROLE;
85+
SET ROLE r2;
86+
SELECT CURRENT_ROLE;
87+
# User b has no UPDATE_PRIV for mysql.user
88+
--error ER_DBACCESS_DENIED_ERROR
89+
SET DEFAULT ROLE r1 FOR a;
90+
SET DEFAULT ROLE r2;
91+
92+
--echo # Change user root (session 1: select_priv to b)
93+
change_user root;
94+
# Let's grant select_priv to user b
95+
GRANT SELECT ON mysql.* TO b;
96+
97+
--echo # Change user b (session 1: select_priv)
98+
change_user b;
99+
SHOW GRANTS FOR b;
100+
# User must have update_priv before setting the role
101+
--error ER_DBACCESS_DENIED_ERROR
102+
SET DEFAULT ROLE r1 FOR a;
103+
# Testing the `CURRENT_ROLE` as a special case
104+
SELECT CURRENT_ROLE;
105+
SET DEFAULT ROLE NONE;
106+
SELECT CURRENT_ROLE;
107+
SET DEFAULT ROLE current_role FOR current_user;
108+
# Testing of non-existing role
109+
--error ER_INVALID_ROLE
110+
SET DEFAULT ROLE invalid_role;
111+
# Testing of non-existing role for different user
112+
--error ER_DBACCESS_DENIED_ERROR
113+
SET DEFAULT ROLE invalid_role FOR a;
114+
# Testing the `None` role for different user
115+
-- error ER_DBACCESS_DENIED_ERROR
116+
SET DEFAULT ROLE none FOR a;
117+
118+
--echo # Change user root (session 2: adding update_priv to user b)
119+
change_user root;
120+
# update_priv are enough
121+
GRANT UPDATE ON mysql.* TO b;
122+
123+
--echo # Change user b
124+
change_user b;
125+
SHOW GRANTS FOR b;
126+
# In all tests in session user a has not been granted the role
127+
# Testing setting role for different user, should fail with new error
128+
--error ER_INVALID_ROLE
129+
SET DEFAULT ROLE r1 FOR a;
130+
# Testing of non-existing role
131+
--error ER_INVALID_ROLE
132+
SET DEFAULT ROLE invalid_role;
133+
# Testing of non-existing role for different user with update_priv
134+
--error ER_INVALID_ROLE
135+
SET DEFAULT ROLE invalid_role FOR a;
136+
# Testing the `None` role for different user with update_priv
137+
SET DEFAULT ROLE none FOR a;
138+
139+
--echo # Change user root (session 3: Grant role to user a)
140+
change_user root;
141+
# After granting the privilege for a, user b can set default role
142+
GRANT r1 TO a;
143+
SET DEFAULT ROLE r1 FOR a;
144+
145+
--echo # Change user a (verify session 3)
146+
change_user a;
147+
SELECT CURRENT_ROLE;
148+
SET DEFAULT ROLE None;
149+
150+
--echo # Change user b (session 3: role granted to user a)
151+
change_user b;
152+
# This should set role because b has update_priv
153+
SET DEFAULT ROLE r1 FOR a;
154+
# Testing non-granted role r2 still should fail
155+
-- error ER_INVALID_ROLE
156+
SET DEFAULT ROLE r2 FOR a;
157+
# Testing of non-existing role
158+
--error ER_INVALID_ROLE
159+
SET DEFAULT ROLE invalid_role;
160+
# Testing of non-existing role for different user
161+
--error ER_INVALID_ROLE
162+
SET DEFAULT ROLE invalid_role FOR a;
163+
164+
# Clear the workspace
165+
change_user root;
166+
--sorted_result
167+
SELECT user, host, default_role FROM mysql.user where user='a' or user='b';
168+
DROP ROLE r1, r2;
169+
DROP USER a, b;

‎mysql-test/suite/roles/set_role-recursive.result

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ Grants for test_user@localhost
6767
GRANT USAGE ON *.* TO `test_user`@`localhost`
6868
GRANT `test_role1` TO `test_user`@`localhost`
6969
set role test_role2;
70-
ERROR OP000: Invalid role specification `test_role2`
70+
ERROR OP000: User `test_user@localhost` has not been granted role `test_role2`
7171
select current_user(), current_role();
7272
current_user() current_role()
7373
test_user@localhost NULL

‎sql/item_xmlfunc.cc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -833,7 +833,6 @@ String *Item_nodeset_func_attributebyname::val_raw(String *nodeset)
833833
String *Item_nodeset_func_predicate::val_raw(String *str)
834834
{
835835
Item_nodeset_func *nodeset_func= (Item_nodeset_func*) args[0];
836-
Item_func *comp_func= (Item_func*)args[1];
837836
uint pos= 0, size;
838837
prepare(str);
839838
size= (uint)(fltend - fltbeg);
@@ -843,7 +842,7 @@ String *Item_nodeset_func_predicate::val_raw(String *str)
843842
((XPathFilter*)(&nodeset_func->context_cache))->append_element(flt->num,
844843
flt->pos,
845844
size);
846-
if (comp_func->val_int())
845+
if (args[1]->val_int())
847846
((XPathFilter*)str)->append_element(flt->num, pos++);
848847
}
849848
return str;

‎sql/set_var.cc

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -973,8 +973,17 @@ int set_var_default_role::check(THD *thd)
973973
{
974974
#ifndef NO_EMBEDDED_ACCESS_CHECKS
975975
real_user= get_current_user(thd, user);
976-
int status= acl_check_set_default_role(thd, real_user->host.str, real_user->user.str);
977-
return status;
976+
real_role= role.str;
977+
if (role.str == current_role.str)
978+
{
979+
if (!thd->security_ctx->priv_role[0])
980+
real_role= "NONE";
981+
else
982+
real_role= thd->security_ctx->priv_role;
983+
}
984+
985+
return acl_check_set_default_role(thd, real_user->host.str,
986+
real_user->user.str, real_role);
978987
#else
979988
return 0;
980989
#endif
@@ -985,7 +994,8 @@ int set_var_default_role::update(THD *thd)
985994
#ifndef NO_EMBEDDED_ACCESS_CHECKS
986995
Reprepare_observer *save_reprepare_observer= thd->m_reprepare_observer;
987996
thd->m_reprepare_observer= 0;
988-
int res= acl_set_default_role(thd, real_user->host.str, real_user->user.str, role.str);
997+
int res= acl_set_default_role(thd, real_user->host.str, real_user->user.str,
998+
real_role);
989999
thd->m_reprepare_observer= save_reprepare_observer;
9901000
return res;
9911001
#else

‎sql/set_var.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#ifndef SET_VAR_INCLUDED
22
#define SET_VAR_INCLUDED
33
/* Copyright (c) 2002, 2013, Oracle and/or its affiliates.
4-
Copyright (c) 2009, 2014, SkySQL Ab.
4+
Copyright (c) 2009, 2020, MariaDB
55
66
This program is free software; you can redistribute it and/or modify
77
it under the terms of the GNU General Public License as published by
@@ -361,6 +361,7 @@ class set_var_default_role: public set_var_base
361361
{
362362
LEX_USER *user, *real_user;
363363
LEX_CSTRING role;
364+
const char *real_role;
364365
public:
365366
set_var_default_role(LEX_USER *user_arg, LEX_CSTRING role_arg) :
366367
user(user_arg), role(role_arg) {}

0 commit comments

Comments
 (0)